Privacy Notice

1. Controller

[Company name], [Address]. Contact: [contact e-mail]

2. What we process

• Account: your e-mail address (for sign-in codes), or the id and e-mail of your Google or Apple account if you sign in with one; your username, display name, avatar, language, time zone, the country you live in and year of birth (only for the age limit and teen accounts; we never ask your birthday).
• Consents: the texts you accepted and the permissions you gave or withdrew, with the version of the text and the date.
• Play: your answers and answer times in the assessment, rated and practice sessions, the hints you opened, your confidence choices (calibration), your ratings and rating history, Mind Card, league rank and weekly points, XP, streak, streak shields, holidays and badges; your Daily Puzzle plays.
• Time accommodation: the time multiplier you choose (×1, ×1.5 or ×2). We never ask why and collect no health or disability information.
• Fair-play signals: in rated play, counts only (how often and how long you left the app or the tab, paste attempts, screenshot events, answer changes, first interaction and elapsed time), the risk assessment computed from them and any case, decision and appeal records. Your screen, camera and typing are never recorded.
• Notifications: your device’s notification token and your notification choices (on or off, reminder time).
• Subscription: the product, status and period end of your store subscription (App Store or Google Play, through RevenueCat). We never receive card or payment details.
• Community: your display name and rank are visible to players in the same league (teen accounts show no name); reports you make or that concern your name, moderation decisions and your appeals.
• Support: the support team sees your account with the least data; it can see details such as your e-mail or year of birth only with a written reason and a second team member’s approval, for at most an hour, and every view is logged.
• Your reports of errors in questions and any note you add.
• Feedback: the message you write to the team in Settings, its topic, the app version and platform; only the support team reads it, and it never goes to analytics.
• Closed beta: the invitation code you joined with and your test group (such as student or accessibility user). The team sets the group when inviting; you are never asked.
• As a guest: the Mind Card assessment with a random session id (cookie); the Daily Puzzle with a random player id, your time zone, the day you played, your attempts and time; we do not ask for your name or e-mail.
• Waitlist: your e-mail address, language, marketing preference and the version of the text you agreed to.
• Security and error logs: limited technical records to prevent abuse and fix bugs; Cloudflare Turnstile bot protection on the waitlist form.
• Analytics: game events (such as a session started, an answer given, a session finished; scores and times only as ranges), as a guest only with your cookie consent and when signed in only with your account’s analytics consent. Regardless of consent, for business metrics: league results, trial and subscription starts or cancellations, and account deletions. Events never contain your name, e-mail, IP address or anything you typed; the analytics service gets an irreversible pseudonym, never your account id.

3. Purposes and legal bases

• Accounts, play, ratings, the league, streaks, notifications, Premium and support: performance of a contract (GDPR Art. 6(1)(b)).
• Security, fair play, moderation, debugging and pseudonymous business metrics: legitimate interests (Art. 6(1)(f)); we document the balancing test.
• Product analytics: consent (Art. 6(1)(a)), which you can withdraw at any time on the Cookie Policy page on the web and in your account Settings.
• Launch and marketing messages: consent; never sent to teen accounts.
• Legal obligations: Art. 6(1)(c).

4. Sharing and transfers

We share data only with processors that help us run the service, under data processing agreements (see the Subprocessors list). For in-app purchases and for delivering notifications to your device, Apple and Google act as separate controllers under their own terms. Transfers outside the EU/UK rely on adequacy decisions or Standard Contractual Clauses. We do not sell personal data.

5. Retention

• Account data: while your account is open. When you delete your account it closes at once, and your e-mail and sign-in identity are permanently deleted within 30 days. Your game records (answers, rating history, league) stay under a pseudonym that cannot be linked back to you, to measure question quality.
• Answers: 24 months, then in a pseudonymised archive.
• Raw fair-play counts: at most 90 days (until a case is settled, if an open case needs them); session risk assessments: 2 years; case records: 2 years after the case closes, and the record of a sanction still in force until it ends.
• Moderation decisions, name reports and support access logs: 2 years.
• Your data copy can be downloaded for 7 days, then it is deleted.
• Analytics events: at most 7 days on our server until sent, at most 24 months in the analytics service.
• Notification token: until you turn notifications off or delete your account.
• Closed beta membership and group: one year after you joined.
• Feedback messages: 2 years.
• Store subscription records: 2 years after the subscription ends (for refunds and disputes).
• Assessment session cookie: 2 hours; afterwards the answers, tied only to a random session id that cannot be linked back to you, are kept to measure question quality.
• Daily Puzzle player cookie: 400 days.
• Waitlist entry: deleted after the launch notice or when you withdraw consent.
• Security logs: at most 90 days.

6. Your rights

You can ask for access, correction, deletion, restriction, portability and object to processing, and withdraw consent at any time. You may also complain to your data protection authority. US residents may have similar rights under state law.

In the app and on your account page, Settings lets you download a copy of your data, change your permissions and delete your account.

Send other requests to [contact e-mail]; we reply within 30 days, free of charge.

7. Age

The youngest age to open an account depends on the country you live in: 15 in Türkiye, 18 in the United States and India, 16 everywhere else (the European Union, the European Economic Area and the United Kingdom included). Accounts of people under 18 are teen accounts: your name is not shown in the league, your badges are not public and you get no marketing messages. If you are under that limit, please do not open an account or join the waitlist; if you enter an age under it when signing up, nothing about you is stored.

8. Automated assessment

Scores, the league and the Mind Card are calculated automatically, for the game only, and have no legal or similarly significant effect on you.

Fair-play signals produce an automated risk assessment, but a fair-play officer always makes any decision, and you can appeal it. An automated filter refuses unsuitable names; for reported names a moderator decides.